unclassified-autoit-compiled: d86e0912 — UPX-packed AUG_SOA.exe, 802 KB compiled AutoIt script in .rsrc

Executive Summary

An AutoIt v3 single-file compiled PE (AutoItSC), UPX-compressed at rest, unpacking to a standard 5-section PE32 with an 802 KB encrypted compiled script stored as RT_RCDATA in .rsrc. The filename AUG_SOA.exe is a business-document lure (Statement of Account / August). This is the eighteenth confirmed sibling in the unclassified-autoit-compiled cluster, and the largest script payload observed to date (802 KB vs previous max 932 KB in f0059bee). Built with MSVC 14.14 (VS 2017) linker, compiled Sep 2024. No dynamic execution available (CAPE skipped: no Windows guest).

What It Is

• SHA-256: d86e0912502ef1c49a35151275b7473ccd62d6e49fa14ad02cdc817b60499a07
• Filename: AUG_SOA.exe (business-document lure — "August Statement of Account")
• Packed: UPX 4.2.2, 3 sections (UPX0, UPX1, .rsrc) — 1,211,904 bytes^[file.txt]
• Unpacked: PE32 x86 GUI, 5 sections (.text, .rdata, .data, .rsrc, .reloc) — 1,717,760 bytes^[rabin2-info.txt]
• Linker: Microsoft linker 14.14 (VS 2017), compiled Sun Sep 15 23:31:14 2024 UTC^[pefile.txt:40]
• AutoIt runtime: v3 single-file compiler (AutoItSC); AU3!EA06 header in script resource^[unpacked_strings.txt]
• Script payload: 802,298 bytes, RT_RCDATA resource type 10, unnamed entry^[pe resource extraction]
• Icons: 11-icon suite in .rsrc (8 in main group ID 99, 3 standalone groups), standard Windows application iconography^[pe resource extraction]
• Version info: Empty VS_VERSIONINFO (zero fields, no strings beyond LangID) — deliberate anti-triage minimalism^[pefile.txt:195-239]
• Signing: Unsigned (no Authenticode certificate)^[pefile.txt:158-160]
• YARA: PE_File_Generic, Likely_Packer_UPX^[triage.json]

How It Works

Packing / Unpacking

UPX-compressed outer shell with standard 3-section layout. UPX0 is uninitialized data (SizeOfRawData=0), UPX1 holds the compressed code. Unpacking restores a normal 5-section PE32 with full import table and .rsrc resources intact.^[file.txt]^[pefile.txt:82-142]

Script Execution Model

The binary is the AutoIt3 interpreter runtime fused with a compiled script. At runtime the interpreter loads the SCRIPT resource from .rsrc, decrypts/decompiles it, and executes the embedded AutoIt bytecode. The script logic itself is opaque to static analysis — the AU3!EA06 header indicates AutoItSC v3 encrypted bytecode, not plaintext source.^[unpacked_strings.txt:0]

Import Surface (Unpacked)

Standard AutoItSC runtime import table — no stripped/minimal IAT. Full surface across 16 DLLs:

• KERNEL32.DLL (167 imports): Process/thread management, memory (VirtualAlloc/Ex, WriteProcessMemory, CreateProcessW), file I/O, registry-adjacent APIs (FindFirstFileW, SetFileAttributesW), debugging detection (IsDebuggerPresent), temp-file creation (GetTempPathW, GetTempFileNameW), resource loading (LoadResource, LockResource, SizeofResource), token/privilege APIs (OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW), pipe creation (CreatePipe).^[r2:ii]
• ADVAPI32.dll (33 imports): Full registry read/write (RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW), token duplication (DuplicateTokenEx), process creation as user (CreateProcessAsUserW, CreateProcessWithLogonW), logon (LogonUserW), SID allocation (AllocateAndInitializeSid), ACL/security descriptor manipulation, system shutdown (InitiateSystemShutdownExW).^[r2:ii]
• USER32.dll (160 imports): GUI automation, window enumeration, clipboard (OpenClipboard, GetClipboardData, SetClipboardData, EmptyClipboard), keyboard/mouse input simulation (SendInput, GetAsyncKeyState, keybd_event, mouse_event, SetKeyboardState), screen capture (GetDC, GetWindowDC), message passing.^[r2:ii]
• GDI32.dll (35 imports): Drawing primitives, bitmap creation (CreateCompatibleBitmap, CreateCompatibleDC), screenshot pipelines (StretchBlt, GetDIBits), font/text metrics.^[r2:ii]
• WININET.dll (14 imports): HTTP/FTP client — InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, HttpQueryInfoW, InternetReadFile, InternetOpenUrlW, FtpOpenFileW, FtpGetFileSize.^[r2:ii]
• WSOCK32.dll (24 imports): Full socket surface — socket, connect, send, recv, sendto, recvfrom, bind, listen, accept, select, gethostbyname, WSAStartup, WSACleanup, gethostname, inet_addr, inet_ntoa, ioctlsocket.^[r2:ii]
• IPHLPAPI.DLL (3 imports): ICMP ping (IcmpCreateFile, IcmpSendEcho, IcmpCloseHandle) — host reconnaissance.^[r2:ii]
• SHELL32.dll (15 imports): ShellExecuteW, ShellExecuteExW, SHGetFolderPathW, SHFileOperationW, SHBrowseForFolderW, SHEmptyRecycleBinW, ExtractIconExW.^[r2:ii]
• PSAPI.DLL (1 import): GetProcessMemoryInfo — process introspection.^[r2:ii]
• MPR.dll (4 imports): WNetUseConnectionW, WNetAddConnection2W, WNetGetConnectionW — network share mapping.^[r2:ii]
• ole32.dll / OLEAUT32.dll / COMCTL32.dll / COMDLG32.dll / USERENV.dll / UxTheme.dll / VERSION.dll / WINMM.dll: COM/OLE automation, common controls, file dialogs, user profile loading, theme queries, version info, multimedia (timeGetTime, mciSendStringW, waveOutSetVolume).^[r2:ii]

Notable Behaviors (Static Inference)

• Process injection surface: VirtualAllocEx + WriteProcessMemory + CreateProcessW + OpenProcess + ReadProcessMemory — the standard AutoIt runtime exports these to scripts via DllCall, making reflective injection trivial for the embedded payload.^[r2:ii]
• Privilege escalation: OpenProcessToken → LookupPrivilegeValueW → AdjustTokenPrivileges enables SeDebugPrivilege before cross-process operations.^[r2:ii]
• Clipboard access: Full clipboard read/write surface (OpenClipboard, GetClipboardData, SetClipboardData, EmptyClipboard) — crypto-clipper capability available to the script.^[r2:ii]
• Screenshot capture: GetDC / GetWindowDC + GDI bitmap primitives (CreateCompatibleBitmap, StretchBlt, GetDIBits) — screen capture available to script.^[r2:ii]
• Keylogging: GetAsyncKeyState imported — keystroke monitoring available.^[r2:ii]
• Network C2 surface: Dual HTTP/FTP (WinInet) + raw sockets (WinSock) + ICMP reconnaissance + network share mapping (MPR). Full malware C2 toolkit exposed to the script.^[r2:ii]
• File masquerade: SetFileTime, SetFileAttributesW — timestamp/attribute manipulation for blending in.^[r2:ii]
• System shutdown: InitiateSystemShutdownExW — wiper or extortion capability.^[r2:ii]

Decompiled Behavior

Ghidra MCP unavailable during this session. Static analysis relies on radare2 and pefile.

Entry point (entry0 at 0x420577) calls an initialization routine (fcn.00420aea) then jumps to the main interpreter loop (0x4203fb). Standard C++ runtime initialization with std::exception vtables (std::bad_alloc, std::bad_array_new_length) observed in the early functions — consistent with MSVC 14.x AutoItSC build.^[r2:entry0]

The .rdata section contains the full AutoIt runtime string table: AutoIt v3 GUI class names, command-line parsing strings (/AutoIt3ExecuteScript, /AutoIt3ExecuteLine, /AutoIt3OutputDebug, /ErrorStdOut), registry paths (Software\AutoIt v3\AutoIt), and the SCRIPT resource name.^[rabin2-info.txt:z]

C2 Infrastructure

No C2 strings recovered. The compiled AutoIt script is encrypted/compiled bytecode. Without dynamic execution (CAPE skipped: no Windows guest), C2 URLs, IPs, domains, mutexes, and named pipes are not observable statically. The import surface confirms HTTP/FTP/socket capability, but the actual endpoints are script-resolved.^[dynamic-analysis.md]

Interesting Tidbits

• Largest script in cluster: 802 KB compiled script exceeds the previous record-holder f0059bee (932 KB plaintext/script source). This sample sits in the upper tier of cluster script sizes.^[/intel/analyses/f0059beebd2edd77495f1b94c756a6706052c3356aca19cf4807ee780629d15f.html]
• Empty version info: VS_VERSIONINFO exists but contains zero values for all version fields and only a LangID translation table. This is deliberate anti-triage — the resource is present so the PE is valid, but contains no discernible metadata.^[pefile.txt:195-239]
• No PDB path: Clean build — no debugging symbols leaked.^[pefile.txt:30]
• TLS callback present: TLS directory at 0x1AF9A4 with 18-byte array — may execute anti-debug before main().^[pefile.txt:173-175]
• canary=true, nx=false: Stack canaries enabled but DEP/NX disabled — consistent with AutoItSC runtime needing executable heap for script JIT/interpreter.^[rabin2-info.txt:9,24]
• pic=true: Position-independent code — supports ASLR relocation.^[rabin2-info.txt:28]

How To Mess With It (Homelab Replication)

Goal: Build a comparable AutoItSC single-file PE with a script payload in .rsrc.

1. Install AutoIt v3 from https://www.autoitscript.com/site/autoit-downloads/
2. Write a simple script (test.au3):

   #include <WinAPIFiles.au3>
   MsgBox(0, "Test", "Hello from compiled AutoIt")
   

3. Compile with AutoIt3Wrapper or SciTE: Compile Script to .exe (x86)
4. Enable UPX compression in the compiler options (or pack post-build with upx --best test.exe)
5. Verify with rabin2 -I test.exe — should show compiler: MSVC, lang: c, canary: true, pic: true
6. Extract script resource: use Resource Hacker or pefile Python script to dump RT_RCDATA type 10
7. Compare capa fingerprint: run capa against your binary; expect "packed" warning and limited static capabilities

What you'll learn: How trivial it is to embed opaque script logic inside a signed-looking PE, and why AutoIt malware remains a staple of crimeware distribution.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_UPX
{
    meta:
        description = "AutoIt v3 single-file compiled PE32, UPX-packed or unpacked"
        author = "PacketPursuit"
        date = "2026-06-25"
        sha256 = "d86e0912502ef1c49a35151275b7473ccd62d6e49fa14ad02cdc817b60499a07"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $autoitsc = ".text$lp00AutoItSC" ascii
        $script_rc = "SCRIPT" wide
        $au3_gui = "AutoIt v3 GUI" wide
        $au3_exec = "/AutoIt3ExecuteScript" wide
        $upx0 = { 55 50 58 30 00 00 00 00 }
        $upx1 = { 55 50 58 31 00 00 00 00 }
    condition:
        uint16(0) == 0x5A4D and
        ($au3_hdr or $autoitsc or ($script_rc and $au3_gui)) and
        (pe.number_of_sections >= 3) and
        ($upx0 or $upx1 or pe.sections[0].name == "UPX0")
}

Sigma Rule

title: AutoItSC Single-File PE Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - '\\AUG_SOA.exe'
        - '\\Invoice.exe'
        - '\\QUOTATION_*.exe'
        - '\\PO_*.exe'
        - '\\BANK_DETAILS_*.exe'
        - '\\DHL_*.exe'
        - '\\FDA.exe'
        - '\\Public_Holiday_Notice_*.exe'
    - CommandLine|contains:
        - '/AutoIt3ExecuteScript'
        - '/AutoIt3ExecuteLine'
        - '/AutoIt3OutputDebug'
        - '/ErrorStdOut'
  condition: selection
falsepositives:
  - Legitimate AutoIt v3 compiled scripts in enterprise environments (rare)
level: high

IOC List

Behavioral Fingerprint Statement

This binary is an AutoIt v3 single-file compiled PE (AutoItSC) that unpacks from a UPX-compressed 3-section shell into a 5-section PE32 with an 802 KB encrypted compiled script stored as RT_RCDATA in .rsrc. The runtime imports 300+ APIs across 16 DLLs including full WinInet/WinSock HTTP-FTP-raw-socket surfaces, clipboard read/write, GDI screenshot primitives, process memory manipulation (VirtualAllocEx/WriteProcessMemory/CreateProcessW), token privilege escalation, and ICMP host reconnaissance. The embedded script logic is opaque; actual C2 endpoints, persistence mechanisms, and payload behaviors are resolved at runtime by the AutoIt interpreter. The sample masquerades as a business document (AUG_SOA.exe — August Statement of Account) and carries empty VS_VERSIONINFO as an anti-triage measure.

Detection Signatures

References

• unclassified-autoit-compiled — Cluster entity page (17 prior siblings)
• autoit-compiled-script-dropper — Concept page for AutoIt deployment patterns
• MalwareBazaar: https://bazaar.abuse.ch/sample/d86e0912502ef1c49a35151275b7473ccd62d6e49fa14ad02cdc817b60499a07/
• AutoIt v3: https://www.autoitscript.com/

Provenance

• Original sample: <sample d86e0912502e.bin> (UPX-packed, 1,211,904 bytes)
• Unpacked sample: /tmp/d86e0912502ef1c49a35151275b7473ccd62d6e49fa14ad02cdc817b60499a07_unpacked.bin (UPX 4.2.2, 1,717,760 bytes)
• Script payload: /tmp/d86e0912502ef1c49a35151275b7473ccd62d6e49fa14ad02cdc817b60499a07_script.bin (802,298 bytes, RT_RCDATA)
• Tools: file (file type), pefile (PE headers/resources), rabin2 (r2 binary info), r2 (disassembly, imports, strings), upx -d (unpacking), strings (string extraction), Python pefile library (resource enumeration)
• Capa: Packed-sample limitation warning — no capability rules matched statically.^[capa.txt]
• Floss: Failed (argument parsing error on triage run, timeout on retry).
• CAPE: Skipped — no Windows guest available.^[dynamic-analysis.md]